CVE-2026-18638 — Velociraptor server crash via the SetPassword API

CVE-2026-18638

Velociraptor server crash via the SetPassword API PUBLISHED

Description (CNA)

Any authenticated Velociraptor user — including one holding only the readerrole — can terminate the entire server process with a single request, by calling SetPassword with a username that does not exist.

Affected (CNA)

Vendor / product	Versions
Rapid7 / Velociraptor	affected 0 before 0.77.2

CWE

CWE-476, CWE-703

References

http://docs.velociraptor.app/announcements/advisories/cve-2026-18638/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.